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Title: SYSTEMS AND METHODS FOR HEALTH MONITOR ALERT 
MANAGEMENT FOR NETWORKED SYSTEMS 



TECHNICAL FIELD 

The present invention relates generally to network administration and control, and 
more particularly to systems and methods for providing health monitor alert management 
and control for networked systems. 



BACKGROUND OF THE INVENTION 

10 Computers were developed to aid people with repetitive tasks that were deemed to 

be extremely time consuming. Most of the early computers were used for complex 
mathematical problem solving. The first computing machines were extremely large 
compared to computers utilized today. Despite their enormous size, the early machines 
had vastly less computing power than today's machines. The sizes of computing devices 

15 were typically driven by the sizes of the existing electronic components of that era. This 

meant that only large research facilities or big businesses could employ computing 
machines. As new technology allowed for smaller electronic devices to be developed, 
computing devices also diminished in size. Although still lacking in power by today's 
standards, the size of the computing machine was reduced enough that it could be placed 

20 on a typical desk. Thus, the "desktop computer" was born. This allowed users to have 
computing technology available in locations other than a central computing building. 
People found that having the capability to utilize computing technology at their work 
desk, rather than submitting computing problems to a central location, made them much 
more productive at their jobs. To make these remotely located computers more 

25 accessible, connections were made between the computers to form "networks." This 

allowed a greater exchange of information from one computing location to another, and, 
in some cases, effectively creating one large computing system. Eventually, the idea of 
moving the desktop computer to the home environment to provide even more 
convenience for doing work became a reality and networks were extended to include 

30 these and other "offsite" locations as well. 
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With the advent of Internet applications, computing system requirements and 
demands increased dramatically. Many businesses, for example, have made important 
investments relating to Internet technology to support growing electronic businesses such 
as e-commerce. Since companies are relying on an ever increasing amount of network 
5 commerce to support their businesses, computing systems generally have become more 

complex in order to ensure that servers providing network services never fail. 
Consequently, system reliability, usage, and management are important aspects to the 
modern business model. These aspects are generally heightened, especially with small 
businesses which must control overages and waste tightly in order to remain competitive 

10 in tight markets. 

A first approach for providing powerful and reliable services utilized a large 
multiprocessor system (e.g., mainframe) for managing servers, for example. Since more 
than one processor may be involved within a large system, services can continue even if 
one of a plurality of processors fails. Unfortunately, these large systems can also be 

1 5 extraordinarily expensive and available to only the largest of corporations. A second 

approach for providing services involves employing a plurality of lesser expensive 
systems (e.g., off-the-shelf personal computers) individually configured as an array to 
support a desired service. Although these systems can provide a more economical 
hardware solution, system management and administration of individual servers is 

20 generally more complex and time consuming. 

Currently, management of a plurality of servers is a time-intensive and 
problematic endeavor. For example, managing server content (e.g., software, 
configuration, data files, components, etc.) requires administrators to explicitly distribute 
(e.g., manually and/or through custom script files) new or updated content and/or 

25 configurations (e.g., web server configuration, network settings, etc.) across the servers. 

If a server's content becomes corrupted, an administrator often has no automatic means 
of correcting the problem. Furthermore, configuration, load-balance adjusting/load 
balance tool selection, and monitoring generally must be achieved via separate 
applications. Thus, management of an entity (e.g., a plurality of computers acting 

30 collectively) as a whole, generally requires individual configuration of loosely coupled 

services that inherently increases errors and time expenditure. 



2 



MS306091.1 

The problems are often compounded when usage of the system includes resource 
utilization that is outside the scope of normal business activity. This taxes the resources 
of the system and reduces profitability of businesses. Some examples of this type of 
activity include, personal emails, web "surfing," and network gaming and the like that are 

5 counter to a business' goals. Thus, administrators are not only tasked with keeping a 

network system up and running, they may also be required to assist the business with fine 
tuning usage of the network itself. This requires information beyond what is typically 
available to a system administrator. This problem is compounded by the fact that most 
small businesses cannot afford to have their own system administrators "in house." 

10 Therefore, most activities are performed from a remote location by a provider who may 

also be servicing many other network systems for other businesses. Thus, the amount of 
information required to efficiently perform normal health monitoring and statusing of 
multi-systems becomes an overwhelming task, especially if a business also expects 
facilitation with improving a system's utilization. 

15 

SUMMARY OF THE INVENTION 

The following presents a simplified summary of the invention in order to provide 
a basic understanding of some aspects of the invention. This summary is not an extensive 
overview of the invention. It is not intended to identify key/critical elements of the 

20 invention or to delineate the scope of the invention. Its sole purpose is to present some 

concepts of the invention in a simplified form as a prelude to the more detailed 
description that is presented later. 

The present invention relates generally to network administration and control, and 
more particularly to systems and methods for providing health monitor alert management 

25 and control for networked systems. A data gathering service is leveraged to provide 

information regarding a system's health state via a computing entity, local and/or remote. 
This provides an optimized means to aggregate a single network's data and/or multiple 
networks' data, decreasing the amount of effort required by system administrators to 
manage health related alerts. By providing customizable aggregated health data, an 

30 administrator can efficiently maintain more networks in substantially the same amount of 

time it took to previously manage a substantially smaller amount of networks. The 
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administrator also gains an ability to provide health related system state information to a 
customer that requests network-related health data. In one instance of the present 
invention, a data gathering service aggregates health data from systems administered by 
the administrator and provides access to this information via a communication means. 
5 such as the Internet, for example. This permits administrators to interface with pertinent 

information virtually anywhere they can find access to the communication means. Thus, 
the present invention vastly improves administrative productivity while enhancing the 
utilization of systems being administered to. In another instance of the present invention, 
aggregated, averaged data is utilized to provide manual and/or automatic control and/or 

10 management facilitation of health monitoring related tasks. 

To the accomplishment of the foregoing and related ends, certain illustrative 
aspects of the invention are described herein in connection with the following description 
and the annexed drawings. These aspects are indicative, however, of but a few of the 
various ways in which the principles of the invention may be employed, and the present 

1 5 invention is intended to include all such aspects and their equivalents. Other advantages 

and novel features of the invention may become apparent from the following detailed 
description of the invention when considered in conjunction with the drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

20 FIG. 1 is a block diagram of an information and control system in accordance 

with an aspect of the present invention. 

FIG. 2 is another block diagram of an information and control system in 
accordance with an aspect of the present invention. 

FIG. 3 is yet another block diagram of an information and control system in 
25 accordance with an aspect of the present invention. 

FIG. 4 is still yet another block diagram of an information and control system in 
accordance with an aspect of the present invention. 

FIG. 5 is a block diagram of an information and control system utilized for 
controlling and setting monitoring alerts in accordance with an aspect of the present 
30 invention. 
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FIG. 6 is a block diagram of an information and control system utilized for 
gathering historical system data in accordance with an aspect of the present invention. 

FIG. 7 is a block diagram of an information and control system utilized for 
providing system utilization information in accordance with an aspect of the present 
5 invention. 

FIG. 8 is a block diagram of an information and control system utilized for 
providing system health and performance information in accordance with an aspect of the 
present invention. 

FIG. 9 is a flow diagram of a method of employing aggregated system data in 
1 0 accordance with an aspect of the present invention. 

FIG. 10 is another flow diagram of a method of employing aggregated system 
data in accordance with an aspect of the present invention. 

FIG. 1 1 is a flow diagram of a method of controlling system utilization in 
accordance with an aspect of the present invention. 
1 5 FIG. 1 2 is a flow diagram of a method of detecting common errors in accordance 

with an aspect of the present invention. 

FIG. 1 3 is a flow diagram of a method of servicing multiple systems in 
accordance with an aspect of the present invention. 

FIG. 14 is a screen shot of an alert notification user interface in accordance with 
20 an aspect of the present invention. 

FIG. 1 5 is another screen shot of an alert notification user interface in accordance 
with an aspect of the present invention. 

FIG. 16 is a screen shot of an alert threshold edit user interface in accordance with 
an aspect of the present invention. 
25 FIG. 1 7 is a screen shot of a monitoring configuration user interface in accordance 

with an aspect of the present invention. 

FIG. 1 8 is a screen shot of a mode selection user interface in accordance with an 
aspect of the present invention. 

FIG. 19 is a screen shot of a reporting options user interface in accordance with an 
30 aspect of the present invention. 
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FIG. 20 is a screen shot of an e-mail options user interface in accordance with an 
aspect of the present invention. 

FIG. 21 is a screen shot of a business owner usage report user interface in 
accordance with an aspect of the present invention. 
5 FIG. 22 is a screen shot of an alerts user interface in accordance with an aspect of 

the present invention. 

FIG. 23 is a screen shot of a user's property settings user interface in accordance 
with an aspect of the present invention. 

FIG. 24 is a screen shot of a fax property settings user interface in accordance 
10 with an aspect of the present invention. 

FIG. 25 is a screen shot of a default web site property settings user interface in 
accordance with an aspect of the present invention. 

FIG. 26 is a screen shot of a logging property settings user interface in accordance 
with an aspect of the present invention. 
1 5 FIG. 27 is a screen shot of a local file property settings user interface in 

accordance with an aspect of the present invention. 

FIG. 28 is a screen shot of a local file property log file settings user interface in 
accordance with an aspect of the present invention. 

FIG. 29 is a screen shot of a database user property settings user interface in 
20 accordance with an aspect of the present invention. 

FIG. 30 is a screen shot of a database role property settings user interface in 
accordance with an aspect of the present invention. 

FIG. 3 1 is a screen shot of an activity report user interface in accordance with an 
aspect of the present invention. 
25 FIG. 32 is a screen shot of an e-mail utilization report user interface in accordance 

with an aspect of the present invention. 

FIG. 33 is a screen shot of a fax utilization report user interface in accordance 
with an aspect of the present invention. 

FIG. 34 is a screen shot of a document utilization report user interface in 
30 accordance with an aspect of the present invention. 
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FIG. 35 is a screen shot of a web utilization report user interface in accordance 
with an aspect of the present invention. 

FIG. 36 is a screen shot of a web access utilization report user interface in 
accordance with an aspect of the present invention. 
5 FIG. 37 is a screen shot of a remote connection utilization report user interface in 

accordance with an aspect of the present invention. 

FIG. 38 is a screen shot of a remote user portal user interface in accordance with 
an aspect of the present invention. 

FIG. 39 is a screen shot of a management console user interface in accordance 
1 0 with an aspect of the present invention. 

FIG. 40 is a screen shot of an overall server summary performance report user 
interface in accordance with an aspect of the present invention. 

FIG. 41 is a screen shot of a performance summary report user interface in 
accordance with an aspect of the present invention. 
1 5 FIG. 42 is a screen shot of a Top 5 performance parameter report user interface in 

accordance with an aspect of the present invention. 

FIG. 43 is a screen shot of a service failure report user interface in accordance 
with an aspect of the present invention. 

FIG. 44 is a screen shot of a critical alert and log errors report user interface in 
20 accordance with an aspect of the present invention. 

FIG. 45 illustrates an example operating environment in which the present 
invention can function. 

FIG. 46 illustrates another example operating environment in which the present 
invention can function. 

25 

DETAILED DESCRIPTION OF THE INVENTION 

The present invention is now described with reference to the drawings, wherein 
like reference numerals are used to refer to like elements throughout. In the following 
description, for purposes of explanation, numerous specific details are set forth in order 
30 to provide a thorough understanding of the present invention. It may be evident, 

however, that the present invention may be practiced without these specific details. In 
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other instances, well-known structures and devices are shown in block diagram form in 
order to facilitate describing the present invention. 

As used in this application, the term '"component" is intended to refer to a 
computer-related entity, either hardware, a combination of hardware and software, 
5 software, or software in execution. For example, a component may be, but is not limited 

to being, a process running on a processor, a processor, an object, an executable, a thread 
of execution, a service, a program, and/or a computer. By way of illustration, both an 
application running on a server and the server can be a computer component. One or 
more components may reside within a process and/or thread of execution, and a 

1 0 component may be localized on one computer and/or distributed between two or more 

computers. A "thread" is the entity within a process that the operating system kernel 
schedules for execution. As is well known in the art, each thread has an associated 
"context" which is the volatile data associated with the execution of the thread. A 
thread's context includes the contents of system registers and the virtual address 

1 5 belonging to the thread's process. Thus, the actual data comprising a thread's context 

varies as it executes. A "state" of a networked system refers to a condition of the 
networked system in relation to, but not limited to, performance, health, and usage 
parameters. A state can be a snapshot of a system's status relating to an historical 
instance in time and/or to a current instance in time and/or a future instance in time. 

20 In FIG. 1, a block diagram of an information and control system 100 in 

accordance with an aspect of the present invention is shown. The information and 
control system (I&C system) 100 is comprised of a user interface 102, a system service 
component 104, and monitored and controlled systems 106-1 12. The user interface 102 
can be any type of interfacing device and/or method that relays and/or accepts 

25 information from a user and/or entity. Thus, the user interface 102 can be a graphical 

user interface and/or a text based interface and the like. It 102 can also include input 
devices such as a keyboard, mouse, pen, touch screen, and/or environmental awareness 
inputs. The input devices can also include serial ports, buses, and other signal input 
devices and the like. The user interface 102 interfaces with the system service 

30 component 104. The system service component 104 is comprised of a control component 

1 14, a data gathering service component 1 16, and a database engine component 118. The 
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system service component 104 can reside on a computing system such as a server 120 
and the like. It 104 can also reside on a desktop computing system and/or on distributed 
computing systems and/or a central computing system. Thus, the system service 
component 104 can reside remotely to a system administrator and/or remotely to a 
5 system being administered to. It is also within the scope of the present invention that 

various sub-components of the system service component 104 can reside in a distributed 
manner. The system service component 104 interfaces with the user interface 102 and 
the systems 106-1 12. The control component 1 14 provides control of the systems 106- 
1 12 by the user interface 102 and/or the data gathering service component 1 16 and/or 

10 another controlling entity (not shown) such as a computing entity and the like, located 
locally and/or remotely. The control component 1 14 can also be structured to provide 
predetermined control with no or minimum prompting by external entities. In other 
instances of the present invention, the control component 1 14 is part of the data gathering 
service component 116. Likewise, it 1 14 can also be part of the user interface 102. The 

1 5 data gathering service component 1 16 provides information relating to the systems 106- 

1 12 to a database system such as that provided by the database engine component 118. 
The database engine component 1 1 8 can be comprised of any type of database engine, 
distributed and/or integrated. Each of the systems 106-1 12 is typically comprised of 
networks owned by a particular client or company, for example. System "N" 112 

20 represents the "nth" system in any number of systems from 1 to infinity. However, 

ownership is not necessarily a definitive element for defining a system. Furthermore, the 
systems 106-1 12 can be comprised of a single computing device or multiple networked 
computing devices in a substantially similar location and/or in a substantially different 
location. Thus, even a remotely located computing device can still be considered part of 

25 a system if so desired. A system can also be comprised of a single network and/or 

multiple networks and/or multiple sub-networks and combinations thereof. 

Generally speaking, the systems 106-1 12 generate health, performance, usage, 
and other data that enables an administrative agent to monitor, control, and report 
different aspects of the systems 106-1 12. Owners of these systems 106-1 12 are usually 

30 small businesses that hire an administrative agent to set up, maintain, and control their 

system. The administrative agent, who is generally in business to provide these services, 
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must also provide similar services to other customers. Thus, the administrative agent 
typically oversees multiple systems owned by multiple clients at a remote location to the 
systems. This creates a huge influx of information that must be assessed by the 
administrative agent. In one aspect of the present invention, the data gathering service 
5 component 1 1 6 aggregates system information such as health, usage, and performance 

information and stores it in the database engine component 1 1 8. This permits the 
administrative agent to access the information and generate aggregated reports. This 
substantially cuts down on the amount of information that must be assessed by the 
administrative agent. It also permits trends and patterns of system errors to be tracked 

10 not only on a single system but over multiple systems to possibly permit prediction of 

common mode failures/errors of a common piece of hardware for instance. Historical 
time-based trends can also be tracked. This permits a system utilizing the present 
invention to provide historical, computer network, and/or multi-site data mining. System 
reports provided by access to the aggregated data permits control responses to be initiated 

15 manually by the administrative agent and/or automatically by the control component 114. 

The automatic responses can be default responses and/or programmed responses by the 
administrative agent. Thus, if a particular user of a system is over utilizing an internet 
bandwidth connection, the present invention provides a means to respond to reduce that 
particular utilization. This permits a case-by-case assessment without requiring a system- 

20 wide mandate to curb a particular system asset. Control can be accomplished for such 

assets as e-mail, internet access, faxing, CPU utilization, and the like. For example, 
reports regarding a particular user's send and receive habits can be generated and 
provided to a client. This adds value to an administrative agent's business. It also 
provides value to the system's owner who can utilize the reports to determine 

25 productivity of individual users of the system. 

By utilizing the aggregated data, the present invention can also reduce faulty or 
"noise 5 ' errors. A system employing the present invention can connect to a service that 
updates/predicts/assists with known bugs/noise errors, and this information can be 
reported to an administrator of the system and/or automatically incorporated as adjusted 

30 threshold alert values and/or changes to a system's state such as updating system 

software and the like to prevent any further bogus errors from occurring. The aggregated 
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data can also be incorporated into a learning system employing artificial intelligence (AI) 
to predict and/or pattern a system into a more productive model. A system, such as an AI 
system, employing the present invention can also be utilized to perform management 
tasks to increase productivity of end-users of the system through employment of 
5 aggregated utilization information. 

Turning to FIG. 2, another block diagram of an information and control system 
200 in accordance with an aspect of the present invention is illustrated. The information 
and control system (I&C system) 200 is comprised of a user interface 202, a 
communication means 204, a servicing center component 206, and various system 

1 0 groupings 208-21 2. The user interface 202 can be any type of interfacing device and/or 

method that relays and/or accepts information from a user and/or entity. Thus, the user 
interface 202 can be a graphical user interface and/or a text based interface and the like. 
It 202 can also include input devices such as a keyboard, mouse, pen, touch screen, 
and/or environmental awareness inputs. The input devices can also include serial ports, 

15 buses, and other signal input devices and the like. The user interface 202 interfaces with 

the servicing center component 206 via the communication means 204. The 
communication means 204 can include, but is not limited to, a global network system 
such as the Internet for example, a LAN network communication means, a WAN network 
communication means, and other communication means accomplished via signal such as 

20 telecommunications, satellite communications, radio communications and the like. The 

servicing center component 206 is comprised of system service component 1214, system 
service component 2 216, and system service component R 21 8, where R represents any 
number from 1 to infinity. The servicing center component 106 interfaces with the 
various system groupings 208-212. The various system groupings 208-212 are 

25 representative of a grouping of systems that represent any number of systems from 1 to 

infinity. System grouping VAP "A" 208 is comprised of multiple systems from 1 to "O," 
where "O" represents any number from 1 to infinity. "VAP" is an acronym for "value- 
added provider" and is typically representative of a for-hire system administrator who 
monitors multiple systems for different clients. In this example, the individual systems 

30 under VAP "A" represent different systems for different clients that have an agreement 

with the same value-added provider, VAP "A.'' System grouping VAP "B" 210 is 
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comprised of multiple systems from 1 to "P," where "P" represents any number from 1 to 
infinity. In this example, the individual systems under VAP 6i ET represent different 
systems for different clients that have an agreement with the same value-added provider, 
VAP lfc B. ?? System grouping VAP "C" 212 is comprised of multiple systems from 1 to 
5 "Q " where "Q" represents any number from 1 to infinity. In this example, the individual 

systems under VAP "C ,? represent different systems for different clients that have an 
agreement with the same value-added provider, VAP "C " 

The servicing center component 206 provides a central entity that services 
multiple VAPs by aggregating information and/or providing control of systems 

10 administered by those VAPs. Thus, system service component 1214 aggregates 

information and/or provides control of systems administered by VAP ;i A." System 
service component 2 216 aggregates information and/or provides control of systems 
administered by VAP "B." Likewise, system service component "R" 218 aggregates 
information and/or provides control of system administered by VAP "C." Although 

1 5 only three sets of VAP systems are shown, one skilled in the art can appreciate that there 

can be any number of VAP system groupings from 1 to infinity. There also can be 
system overlapping such as when a client has multiple VAPs overseeing various aspects 
of a single and/or multiple networks within the client's organization. In this example of 
an instance of the present invention, the user interface 202 represents an interface for 

20 VAP "B." VAP B is chosen only for illustrative purposes. The user interface 202 can be 

an interface for any VAP and/or multiple VAPs. The servicing center component 206 
provides the service component 2 216 to administer data aggregation and/or control of 
VAP B's clients (i.e., networks and the like). This alleviates VAP B of the requirement 
of having equipment that can process and handle the throughput of all of their clients' 

25 system data. The data aggregation and/or control is provided by the system service 

component 2 216, along with any CPU and/or resources required to process the data 
and/or provide control. This permits VAP B to access system service component 2 216 
via the communication means 204 at any remote location serviced by the communication 
means 204. Thus, this instance of the present invention provides relief of asset 

30 possession and relief of limited accessibility of information and/or control by a VAP, 

minimizing the workload of the VAP. The servicing center component 206 additionally 
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has the ability to cross-compare various systems for making a determination if an error, 
such as a hardware error, for example, is a common mode error/failure pertinent to a 
particular entity that may be found in multiple systems. This allows the servicing center 
206 to notify VAPs of a potential for common errors/failures with regard to a particular 
5 entity such as common software and/or hardware entities and the like. It also permits 

erroneous errors and/or software bugs to be eliminated through filtering and/or software 
updates, accomplished manually and/or automatically. 

Looking at FIG. 3, yet another block diagram of an information and control 
system 300 in accordance with an aspect of the present invention is depicted. The 

1 0 information and control system (I&C system) 300 is comprised of a user interface 302, a 

data gathering service component 304, and a database engine component 306. The user 
interface 302 can be any type of interfacing device and/or method that relays and/or 
accepts information from a user and/or entity. Thus, the user interface 302 can be a 
graphical user interface and/or a text based interface and the like. It 302 can also include 

1 5 input devices such as a keyboard, mouse, pen, touch screen, and/or environmental 

awareness inputs. The input devices can also include serial ports, buses, and other signal 
input devices and the like. The user interface 302 interfaces with the data gathering 
service component 304 and/or the database engine component 306. The data gathering 
service component 304 is comprised of system and user control parameters 308, 

20 aggregation rules parameters 3 1 0, output/reports rule set parameters 3 1 2, e- 

mail/pager/etc. contact rules parameters 3 1 4, and additional parameters 316. The system 
and user control parameters 308 provide manual and/or automatic control of various 
system parameters based upon information aggregated by the data gathering service 
component 304. This enables a user and/or entity to manipulate assets of a client's 

25 system in order to achieve optimal utilization of that system for its intended purpose. 

These parameters 308 can be set via the user interface 302 and/or utilize default values 
set by the data gathering service component 304 and/or by an additional entity such as an 
AI controlling unit. The aggregation rules parameters 3 1 0 provide a means for the data 
gathering service component 304 and/or the user interface 302 to control how and/or 

30 what and/or when and the like that gathered information is aggregated. This permits a 

powerful amount of control over administration of a system. It allows only information 
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that is deemed of high importance to a user (e.g., value-added provider (VAP)) to be 
presented in an efficient manner, saving vast amounts of time and/or manual composition 
effort of the same information. Aggregated data will inherently have greater value than 
the sum of its parts due to the added benefits of showing trend data and other hidden data. 
5 Finding hidden data is often referred to as "data mining." The aggregated data provided 

by the present invention allows exploitation of a data set not previously obtainable. The 
output/reports rule set parameters 312 allow a user utilizing the user interface 302 to set 
rules that govern what and/or how information is presented. This allows a VAP to 
provide clients with an informative and detailed report that is tailored for that particular 

10 client. The e-mail/pager/etc. contact rules parameters 314 allow control of what and/or 

under what conditions a contact can be initiated. Thus, if a server has gone down but 
resets itself within 2 minutes, a user could decide that that is sufficiently within a client's 
tolerance level and choose not to be notified. However, the same condition that is not 
reconciled within 3 minutes can prompt a contact by the data gathering service 

1 5 component 304. This alerts a VAP to a possibly serious condition. Since the VAP can 

control under what circumstances they are notified, a notification can be deemed to need 
immediate attention by the VAP rather than the VAP being inundated with contacts for 
minor system problems that do not require their immediate attention. One skilled in the 
art can appreciate that other parameters can be utilized by the data gathering service 

20 component as represented by the additional parameters 316. Thus, the data gathering 

service component 304 is not limited solely by those parameters illustrated in FIG. 3. 
Due to the enormous value of the aggregated data, users obviously can find the 
information invaluable in ways that are explicitly stated and/or illustrated, but are within 
the scope of the present invention. Thus, the present invention allows for the flexibility 

25 of providing parameters that a user can manually manipulate and/or permit automatic 

manipulation based upon an aspect and/or related aspect of the aggregated data. 
Although not expressly shown in FIG. 3, it has been discussed supra that the data 
gathering service component 304 utilizes the database engine component 306 to store 
gathered data. This permits the user interface 302 to facilitate in generating reports 

30 and/or views of data for display/dissemination by either interfacing with the data 
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gathering service component 304 and/or directly with the stored data in the database 
engine component 306. 

Referring to FIG. 4, still yet another block diagram of an information and control 
system 400 in accordance with an aspect of the present invention is shown. The 
5 information and control system (I&C system) 400 is comprised of user interfaces 402, 

database engine component 404, data gathering service component 406, additional data 
sources 408, running processes 410, and logs 412. The user interfaces 402 is comprised 
of a historical view of system health 414, a historical view of system usage data 416, 
historical view of system state 418, custom view written by user 420, health monitor alert 

1 0 modifier 422, and interface "X" 424, where X represents any number of interfaces from 1 

to infinity and/or any type of interface. The user interfaces 402 interface with the 
database engine component 404 and/or the data gathering service component 406 to 
obtain data to generate various user interfaces represented by the user interfaces 402 
and/or receives generated reports directly from the data gathering service component 

1 5 406. The data gathering service component 406 additionally interfaces with the database 

engine component 404 to provide information relating to a system and/or provide 
generated reports to the user interfaces 402. A representative, but incomplete, example of 
such information that is obtainable by the data gathering service component 406 includes, 
but is not limited to, additional data sources 408, running processes 410, and logs 412. 

20 The additional data sources 408 is comprised of health monitor alerts 426, registry 428, 

and data source "W ?? 430, where W represents any number of data sources from 1 to 
infinity and/or unlimited types of data sources. The running processes 410 is comprised 
of WMI (Microsoft's Windows Management Instrumentation) 432, health monitor 434, 
command line task 436, and process "Z" 438, where Z represents any number of running 

25 processes from 1 to infinity and/or unlimited types of processes. The logs 412 are 

comprised of an exchange log 440, a fax log 442, VPN (Virtual Private Network) logs 
444, IIS (Internet Information Server) log 446, event log 448, RRAS (Microsoft's 
Routing & Remote Access Service) internet connection log 450, and "Y" log 452, where 
Y represents any number of logs from 1 to infinity and/or unlimited types of logs. 

30 FIG. 4 represents an example of an instance of the present invention of a single 

system and the types of data that the data gathering service component 406 interfaces 
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with. These different types of data sources 408-412 are representative and not meant to 
be all inclusive. The data gathering service component 406 aggregates this information 
from at least one of the data sources 408-412. This information is then stored on the 
database engine component 404. The database engine component 404 can be a 
5 distributed type of database engine and reside on a server that is controlled by user such 

as a VAP. The user interfaces 402 can retrieve aggregated data directly from the 
database engine component 404 and/or the data gathering service component 406. The 
user interfaces 402 can additionally interface with the data gathering service component 
406 to provide parameters utilized by the data gathering service component 406 in its 

10 data aggregation related tasks. These related tasks include, in this illustration, control of 

the system along with such tasks as system alert reporting and aggregation control. 

In FIG. 5, a block diagram of an information and control system 500 utilized for 
controlling and setting monitoring alerts in accordance with an aspect of the present 
invention is illustrated. The information and control system (I&C system) 500 is 

1 5 comprised of a database engine component 502 such as, for example, Microsoft's SQL 

(Structured Query Language) Server Database Engine (MSDE); a user interface 504 for 
providing a means to receive information and to control a process; data sources 506, such 
as, for example, running processes such as Microsoft's Window Management 
Instrumentation (WMI); and a controllable process 508 such as, for example, a health 

20 monitor process. In this example of an instance of the present invention, the I&C system 

500 is utilized to monitor and set thresholds for a health monitoring process of a system. 
As an example illustrating data interaction, the user interface 504 interacts with the 
database engine component 502, the data sources 506, and the controllable process 508. 
The user interface 504 receives historical data 510 from the database engine component 

25 502 that can be, for example, rolling average data relating to a health monitor process. 

Additional desired information such as, for example, name space data 512 such as 
instantaneous state of services data is obtained from the data sources 506. The user 
interface 504 also interacts with the controllable process 508 to obtain current alert 
settings 516 from the controllable process 508 and also interacts to send new alert 

30 settings 514 to the controllable process 508. In this manner, the user interface 504 can 

provide valuable status and alert information pertaining to a particular process in a 
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system. As in the example of the health monitor alert modifier, health alerts and alert 
thresholds can be easily set, even by inexperienced system administrators, due to the I&C 
system 500 providing historical information and suggestions based on that historical 
information to facilitate in alert setting, automatically and/or manually. 
5 A small business server environment desires robust administration tools without 

imposing extensive burdens and complexities on system administrators. The present 
invention can be incorporated in a system that provides for accumulating tailored 
information about the health of a server s environment and utilizing information to 
provide useful administrative guidance. In one instance of the present invention, the 

10 present invention provides a simplified user interface to a server environment health 

monitoring and alert system — -providing for definition and implementation of alerts 
based on instantaneous measurements and time averaged data. Thus, the present 
invention can, for example, bring together a health monitor process and an historical 
system state utilizing a database engine component such as Microsoft's SQL's MSDE 

15 engine in order to provide a user a historical view of relevant data to enable a better 

understanding of related alerts. Furthermore, the present invention also provides a simple 
user interface for setting thresholds in a process such as, for example, the health monitor 
process. Historical data is very effective in facilitating a user to select a threshold for 
alerting. Each system and network runs differently, and the present invention provides a 

20 rolling average of data. Ultimately, this helps minimize frivolous alerts and time spent by 

a system's owner, both in setting alerts and in responding to alerts. 

FIG. 5 illustrates, as an example, such a system for providing a simplified method 
for modifying alert thresholds in a health monitor process as well as providing control for 
turning on and off related alerts. Additionally, the present invention provides averaging, 

25 such as a rolling 30 day average, of data corresponding to alert thresholds. This allows a 

user to make informed decisions when setting the alert thresholds, since the data is based 
on actual system measurements. 

In order to provide information for enhancing system interaction with a user, the 
present invention provides a means to gather historical data that can be utilized to 

30 facilitate a user's administration of the system. In FIG. 6, a block diagram of an 

information and control system 600 utilized for gathering historical system data in 
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accordance with an aspect of the present invention is shown. The I&C system 600 is 
comprised of a data gathering service component 602; a database engine component 604 
such as Microsoft's SQL Server Database Engine; an historical user interface 606; an 
optional customized user interface 608: a running process 610 such as a command line 
5 task process; and various log and alert databases 612-624. The various log and alert 

databases are comprised of, for example, an exchange log 612, a fax log 614, VPN logs 
616, an IIS log 618, an event log 620, an RRAS internet connection log 622, and a health 
monitor alerts database 624. The various log and alert databases 612-624 are 
representative examples and are not meant to be required and are not an exhaustive list of 

10 all possible log and alert databases. In this example of an instance of the present 

invention, the data gathering component 602 obtains information from the logs 612-622. 
This information is then stored utilizing the database engine component 604. The 
running process 610 can also provide data to the database engine component 604 from 
other databases such as the health monitor alerts database 624. This allows a user to 

15 access information from an interface such as the historical user interface 606. The user 

can also modify and/or create an interface to construct the optional customized user 
interface 608. This permits versatility to tailor the interface to user's desired 
configuration. The data gathering service component 602 can actively retrieve data from 
various data sources through polling and the like and/or it 602 can passively receive data 

20 transmitted by the various data sources on a periodic and/or aperiodic basis. Thus, the 

present invention provides a means to view and assess historical system information to 
facilitate in optimizing future system performance, track error events, and determine 
trends and the like for a given system. 

The present invention can be incorporated in a system that provides for 

25 accumulating tailored information about a state of a system such as, for example, the 

health of a server environment and utilizes gathered information to provide useful 
administrative guidance. In one instance of the present invention, collection of 
information is facilitated by bringing together a distributed database engine such as, for 
example, an SQL MSDE engine and several sources of system information to provide for 

30 historical monitoring of an entire system state. System information can be collected from 

running processes such as, for example, a health monitor process and also collected from 
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logged data such as, for example, an event log, an Exchange log, an IIS log, and a fax 
log. The system information is then inserted into a server such as, for example, an SQL 
server, where customized reports can be generated and provided to the customer. The 
present invention enables users/clients to more accurately and quickly monitor the overall 
5 health and utilization of their server and network, reducing system operating costs. It 

also provides for rich data mining of system data by utilizing, for example, a custom 
schema installed into a database engine component such as MSDE. Thus, when data is 
collected, it can be inserted into a structured format such as, for example, schema tables. 
The data can then be retrieved utilizing predefined user interfaces or "views," for 

10 example, for web viewing and e-mail reporting. 

Another instance of the present invention provides a system administrator with 
periodic reports on system utilization based on user and system defined criteria and the 
like. The present invention brings together utilization data from a variety of 
administrator and system defined sources to create these reports and/or provide 

1 5 utilization control of the system. In FIG. 7, a block diagram of an information and 

control system 700 utilized for providing system utilization information in accordance 
with an aspect of the present invention is depicted. The I&C system 700 is comprised of 
a data gathering service component 702; a database engine component 704 such as, for 
example, Microsoft's SQL Server Database Engine; and a user interface 706 such as an 

20 historical view of system utilization data and the like. The present invention brings 

together historical data collection services and data storage engines such as, for example, 
SQL's MSDE engine, for data storage in order to present a system administrator and 
system owner/client a unified view of overall utilization of the system and/or utilization 
control of the system, reducing system costs and improving system utilization. 

25 In a typical example of the present invention, a data collection service runs once 

daily and collects a wide range of system data. It then stores this set of collected 
information in a database engine component, viewable via a defined view of system 
utilization data based on the set of collected information. This view or report can be 
based on user input based on a wide base set of statistics the user finds useful. Providing 

30 users with this type of report saves them from having to log on to a system and pour 

through logs from many different sources. This ultimately saves time and money to a 
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users client or owner of the system. A system utilization report shows a client how their 
system users are interacting with their system. This provides information that a client can 
utilize to enhance the performance of the system and/or utilize to enhance the 
performance of the system's user. For example, if a particular system user or employee 
5 has a high e-mail send and/or receive usage along with hours of internet usage per day, 

an employer {i.e., the client) can adjust the situation directly by confronting the employee 
about productivity and/or the employer can inform a system's administrator (i.e., user) to 
restrict that particular employee's internet bandwidth and emailing capabilities. Thus, the 
present invention goes beyond just enhancing a system's performance, but can also be 

10 utilized to enhance the productivity and/or management of employees utilizing a client's 

system. Similarly, the present invention can be used to directly monitor employee 
activities to provide a substantially real-time monitor of their productivity. Reports 
and/or controlling actions can be implemented manually and/or automatically based 
upon the aggregated utilization data. Beyond solely monitoring employee activity, the 

15 present invention can also be utilized to actually enforce business rules based on a 

business owner's preferences utilizing positive feedback. For example, a business rule 
could require that no single employee can utilize more than 5% of available bandwidth 
allotted by a system administrator for non-critical utilization such as, for example, 
internet web browsing, This naturally enforces the business rule while protecting a 

20 networked system's bandwidth for critical applications such as, for example, system 

backup and/or e-mail applications. 

Yet another instance of the present invention brings together historical data 
collection services and data storage engines such as, for example, an MSDE engine, for 
data storage in order to present a system administrator/user and system client/owner a 

25 unified view of overall health of a system. Looking at FIG. 8, a block diagram of an 

information and control system 800 utilized for providing system health and performance 
information in accordance with an aspect of the present invention is illustrated. The I&C 
system 800 is comprised of a data gathering service component 802; a database engine 
component 804 such as, for example, Microsoft's SQL Server Database Engine; a user 

30 interface 806 such as an historical view of system health and the like; an optional user 

interfaces such as, for example, an historical view of system performance and the like 
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812; additional database 810 such as, for example, a system registry; and a running 
process 808 such as ; for example, Microsoft's Windows Management Instrumentation. 

In one instance of the present invention, a data collection service runs once per 
hour and collects a wide range of system health and/or performance data. It then stores 
5 this collected set of information in a database engine component such as an MSDE store. 

The present invention provides a user/administrator with a view/interface of system 
health and performance data utilizing the set of collected information. Based on 
customer input and/or system defaults, a system health and performance report is defined 
with a wide base set of statistics that are relevant and useful to a user and to a user's 

1 0 client. Providing users with this type of report saves them from having to log on to a 

system and pour through logs from many different sources. This ultimately saves time 
and money to a system's owner/client, showing explicitly any performance and/or 
functionality problems with a server and/or network. 

In view of the exemplary systems shown and described above, methodologies that 

1 5 may be implemented in accordance with the present invention will be better appreciated 

with reference to the flow charts of FIGs. 9-13. While, for purposes of simplicity of 
explanation, the methodologies are shown and described as a series of blocks, it is to be 
understood and appreciated that the present invention is not limited by the order of the 
blocks, as some blocks may, in accordance with the present invention, occur in different 

20 orders and/or concurrently with other blocks from that shown and described herein. 

Moreover, not all illustrated blocks may be required to implement the methodologies in 
accordance with the present invention. 

The invention may be described in the general context of computer-executable 
instructions, such as program modules, executed by one or more components. Generally, 

25 program modules include routines, programs, objects, data structures, etc., that perform 

particular tasks or implement particular abstract data types. Typically the functionality of 
the program modules may be combined or distributed as desired in various embodiments. 

In FIG. 9, a flow diagram of a method 900 of employing aggregated system data 
in accordance with an aspect of the present invention is shown. The method 900 starts 

30 902 by obtaining data from at least one system data source 904. Data sources can 

include, but are not limited to, logs, running processes, databases, and other data sources 
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and the like. The data itself can be 5 but is not limited to, performance data, health data, 
and utilization data and the like. Any parameter of a system and/or any information that 
can be utilized in an aggregated form to facilitate an aspect of a system is employable in 
the present invention. Data can be actively and/or passively obtained. The data is then 
5 aggregated according to predetermined rules 906. The predetermined rules can be 

determined by a user such as a VAP and/or by a system given certain "guidance rules" 
set by the user and/or by an AI entity that automatically provides rules and/or guidance. 
These guidance rules allow a system to automatically respond to aggregated data in a 
desirable fashion. The aggregated data is then stored in a distributed database engine 

1 0 store 908. The distributed database engine store can be a store such as an MSDE store 

and the like. Reports and/or views based upon the stored aggregate data are then 
generated 910, ending the flow 912. The generated information is typically based upon a 
desired user request that is stimulated by a predetermined request and/or determined by a 
customized user request set. The generated information can include, but is not limited to, 

1 5 aggregated information and/or aggregated data mined information such as trend data 

and/or prediction data. The present invention also provides a means for regressing a 
system's state when changes have been made to the system that cause unexpected results. 
A user can initiate a "return to previous state X" to provide for a functioning system once 
again. This can be accomplished by a system utilizing prior aggregated data to determine 

20 the previous state X. In the same fashion, remedial action can be taken when aggregated 

data indicates problems that a system can automatically respond to such as, for example, 
when a disk low error is detected, temporary files could be automatically deleted to gain 
more disk space, avoiding a disk crash. Likewise, security holes and hacking attempts 
can be avoided by utilizing the aggregated data and automatically downloading a security 

25 fix and/or shutting down a vulnerable server and the like. 

Referring to FIG. 10, another flow diagram of a method 1000 of employing 
aggregated system data in accordance with an aspect of the present invention is depicted. 
The method 1000 starts 1002 by obtaining system data from system logs 1004. The logs 
can include, but are not limited to, exchange logs, fax logs, VPN logs, IIS logs, event 

30 logs, and RRAS internet connection logs and the like. System data is also obtained from 

processes running in the system 1 006. These processes can include, but are not limited 
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to, health monitoring processes, performance monitoring processes, and utilization 
monitoring processes and the like. Additional system data is also obtained from other 
system data sources 1008. These additional data sources can include, but are not limited 
to, health monitor databases, performance monitoring databases, and utilization 
5 monitoring databases and the like. Data can be obtained in a variety of means such as, 

for example, by direct polling and/or transmission by data sources themselves such as via 
broadcasts, multicasts, and/or unicasts and the like. The system data is then aggregated 
according to predetermined rules 1010. The predetermined rules can be determined by a 
user such as a VAP and/or by a system given certain "guidance rules" set by the user 

10 and/or by an AI entity. These guidance rules allow a system to automatically respond to 

aggregated data in a desirable fashion. The aggregate data is then stored in a distributed 
data engine store 1012. This permits easy distribution of the data to a user. Initiated by a 
user and/or automatically by a system, performance related reports and/or views are 
generated based on the aggregated performance data stored in the distributed data engine 

15 store 1014. Likewise, health related reports are generated based on the aggregated health 

data stored in the distributed data engine store 1016. The generated health reports/views 
are initiated like the performance reports/views either by a user and/or automatically by a 
system. Utilization reports and/or views are also generated based on the utilization 
aggregated data found on the distributed data engine store 1018, ending the flow 1020. 

20 Again, the reports/view can be initiated by a user and/or automatically by a system. 

Thus, the present invention provides flexibility of not only employing different types of 
data, but also in aggregation rules, and in generating information to be utilized either by a 
system for automatic control/artificial intelligence, or by a user responding to the 
generated information. 

25 Turning to FIG. 1 1 , a flow diagram of a method 1 1 00 of controlling system 

utilization in accordance with an aspect of the present invention is illustrated. The 
method 1 100 starts 1 102 by obtaining system utilization data from a system 1 104. The 
utilization data is aggregated according to predetermined rules 1 1 06. The predetermined 
rules can be determined by a user such as a VAP and/or by a system given certain 

30 "guidance rules" set by the user and/or an AI entity. These guidance rules allow a 

system to automatically respond to aggregated data in a desirable fashion. The present 
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invention can also utilize artificial intelligence to take the place of the guidance rules set 
by the user. This allows a system to be completely autonomous. The aggregated 
utilization data is then stored in a distributed database engine store 1 108. This permits 
access to the data by a user and/or by a system. Desired data parameters are then 
5 generated based on the aggregated utilization data stored on the distributed database 

engine store 1110. Desired parameters can include, but are not limited to, internet 
bandwidth of single system user, internet bandwidth of an entire system, memory 
utilization of a system, storage utilization of a server, e-mail utilization of a single system 
user and/or a group of system users, and any data that can indicate utilization of a system 

10 as a whole and/or of an individual system user and/or group of system users and the like. 

The desired data parameters can be derived from necessary data required for a particular 
control command and the like so that a system can automatically respond to the 
parameter and/or enable a capability to allow a manual response. Thus, the desired data 
is processed to produce system control parameters 1112. The system control parameters 

1 5 can be indicated actions to a user either by reporting a certain level of activity needing 

investigation and/or a response suggestion that can be easily initiated by a predetermined 
response pattern/sequence. The system control parameters can also be formulated to 
provide direct responses to an automated system for controlling a system's utilization. 
This allows control of at least one utilization aspect of a system by employing the system 

20 control parameters 1114, ending the flow 1116. The controlled aspect, whether 

automatic and/or via a user input, can include such things as limiting bandwidth, limiting 
emails, limiting faxes, limiting internet usage, and/or limiting other system assets. The 
system control parameters can also be utilized to load shed during high peak periods and 
the like at critical utilization maximums and/or utilized to load balance between more 

25 than one system and/or between more than one server in one or more systems. The 

control parameters can also be employed in management and/or productivity tools 
relating to end-users of a system. In this manner productivity can be increased through 
periodic and/or aperiodic interfacing with system utilization related data. Utilization data 
can also be employed to prioritize utilization of a system. For example, if boss X wants 

30 to process payroll, the initiation of the payroll process causes junior employee's internet 

downloading processes to be subservient to the boss X's payroll process automatically. 
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Looking at FIG. 12, a flow diagram of a method 1200 of detecting common errors 
in accordance with an aspect of the present invention is shown. The method 1200 starts 
1202 by obtaining system data from at least one system 1204. The system data is 
aggregated according to predetermined rules 1206. The predetermined rules can be 
5 determined by a user such as a VAP and/or by a system given certain "guidance rules" 

set by the user and/or an AI entity. These guidance rules allow a system to automatically 
respond to aggregated data in a desirable fashion. The aggregated data is then stored in a 
distributed database engine store for easy access 1208. A determination is then made as 
to whether the aggregated data indicates possible common errors that occur across 

1 0 multiple servers and/or multiple systems 1210. Common errors can be associated with 

common hardware and/or common software. Thus, part of the aggregated data typically 
contains configuration data for servers and/or systems. It is not uncommon for a 
particular piece of hardware to have a "common mode failure" that can appear in other 
devices utilizing that particular piece of hardware and/or can appear when a given 

15 particular software thread is run. By utilizing this information in an aggregate form, 

common errors can be eliminated by intervention and/or masking if they create false 
alerts. Thus, reports and/or views based on the common mode errors are generated 1212, 
ending the flow 1214. System control commands can also be generated to allow an 
automatic response by a system to a possibly harmful and/or catastrophic type hardware 

20 and/or software failure. Similarly, the present invention can be utilized to automatically 

fix simpler problems if it is aware of a correct system state for a given system. For 
example, if a single process takes 100% of a system's CPU processing time for more than 
a given amount of time, for example - 10 minutes, and the process has not been indicated 
as a critical operation, the process can be throttled to ensure that the rest of the system 

25 remains responsive. A report can then be generated notifying a system administrator 

and/or a system owner that a problem exists and that it has been mitigated to avoid any 
apparent adverse effects to a system's users. The present invention also provides a means 
to notify and/or automatically update software and the like when potential problems 
and/or software bugs appear. In this manner, software fixes can be automatically loaded 

30 without a VAP's intervention. Likewise, if an immediate fix is not available for a known 

bug in a software version, the error can be masked so as to not appear as a false alert to a 
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system and/or a user. The aggregated data can also show trends and/or patterns that 
might indicate a possible disastrous situation and/or possibly an intentional attack on a 
server and/or system. 

Referring to FIG. 13, a flow diagram of a method 1300 of servicing multiple 
5 systems in accordance with an aspect of the present invention is depicted. The method 

1300 starts 1302 by obtaining at least one system data set for at least one user {e.g., VAP) 
1304. System data sets that belong to a particular user (VAP) are aggregated according 
to that user's predetermine rules 1306. Likewise, each additional set, if applicable, of 
system data is also aggregated according to each individual user. This permits, for 

1 0 example, a single computing and/or hosting entity to provide system aggregation and/or 

control services for multiple users (VAPs) in a single and/or "apparently" single remote 
location to the users. The aggregated data sets are then stored in a database engine store 
for easy retrieval 1308. Remote access is then provided to any number of users for 
accessing their aggregate data via a communication means 1310. The communication 

1 5 means can include, for example, the Internet, telecommunications, radio communications, 

and satellite communications and the like. Reports and/or views based on a particular 
user's aggregated system data is generated in response to a user query and/or a user's 
system 1312, ending the flow 1314. Thus, the present invention provides a means to 
allow the output to directly control the user's system and/or prompt a user of alerts via 

20 paging, emails, and telephone calls and the like without requiring the user to be at any 

particular terminal to access information regarding systems under their administration. 

The present invention additionally employs the supra structures and methods to 
provide graphical user interfaces to facilitate information dissemination to a user such as, 
for example, a system administrator and/or a system owner such as, for example, a 

25 system administrator's client. Different UI configurations can be created utilizing the 

present invention. In one instance of the present invention, a health monitor 
configuration UI is provided. This UI permits a user to configure appropriate alerts and 
settings relating to a server and/or a system that the user administers. In this manner the 
user can modify and set such aspects of a health monitor function such as alert thresholds, 

30 notification means for alerts, and which alerts to monitor for a server and/or a network 

and the like. An example UI for setting alert notifications is illustrated in an alert 
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notifications Ul 1400 shown in FIG. 14. The present invention provides access to 
historical data allowing averages of past data to be calculated to facilitate a user in 
choosing appropriate alert thresholds, shown in another view of the alert notifications UI 
1 500 in FIG. 1 5. Thus, an average of the last 30 days, for example, can be displayed for 
5 a monitored alert. The alert notifications UI 1500 also illustrates that individual alert 

notifications can be enabled or disabled. An alert threshold edit UI 1600 is shown in 
FIG. 16. This UI 1600 provides a means to individually edit and/or set a threshold for an 
alert. In this illustration 1600, the alert is currently set to "less than 20MB" and a 30-day 
average for the system and/or server of 1 8.5MB. Thus, a user easily recognizes that the 

10 free memory has fallen below the 20MB threshold during the last 30 day period. If 

utilizing 18.5MB is still acceptable to the user, they can change the alert threshold to 
1 8MB as illustrated in this example to avoid receiving any further unnecessary alerts. 

Another instance of the present invention facilitates a user in becoming more 
proactive in addressing issues with a client's networks through proper monitoring and 

1 5 reporting. It can also configure monitoring and reporting such that a client can have 

direct report access. A monitoring configuration UI 1700 as illustrated in FIG. 17 can 
provide a quick and easy way for users to immediately start receiving default monitoring 
and reports. The UI 1700 improves visibility and usage numbers related to monitoring 
and allows for easy re-configuration. A mode selection UI is shown in FIG. 18. This is 

20 an example of a configuration entry interface that provides further capability to select 

and/or deselect features such as an option to receive performance reports via e-mail (see 
reporting options UI 1900 in FIG. 19, for example), an option to view usage reports in a 
management console (see reporting options UI 1900 in FIG. 19, for example), an option 
to receive usage reports via e-mail (see reporting options UI 1900 in FIG. 19, for 

25 example), an ability to modify e-mail addresses that reports are sent to (see e-mail 

options UI 2000 in FIG. 20, for example), an ability to modify a list of users that can 
access a client's website in order to view usage reports from the Intranet (see business 
owner usage report UI 2100 in FIG. 21, for example), an option to receive health monitor 
related alerts (see alerts UI 2200 in FIG. 22, for example), an ability to modify e-mail 

30 addresses that health monitor related alerts are sent to (see alerts UI 2200 in FIG. 22, for 

example), and an ability to reconfigure monitoring features from scratch (refer back to 
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mode selection UI 1 800 in FIG. 1 8) and the like. Various properties related to a system, 
including database properties and roles, can be manipulated as well by a user as 
illustrated in UFs 2300-3000 shown in FIGs. 23-30. These are meant to be representative 
examples only and are not meant to limit the scope of the present invention. 
5 Yet another instance of the present invention facilitates monitoring utilization of a 

system and/or server and the like. Additional UFs are employed to provide clients with 
valuable information about utilization of their network by network users, to ensure 
information is relevant and applicable to clients through re-settable data collection and/or 
specific data collection time period selections, to provide statistics for a network's core 

10 services, to facilitate a new channel of value for users such as VAPs, for example, to 

account for server and/or network downtime, and to conserve disk space on a network 
and/or server and the like. A client, with access privileges, can interface with an activity 
report UI 3100 as shown in FIG. 31. Reports generated by the present invention include, 
but are not limited to, an e-mail utilization report (see e-mail utilization report UI 3200 in 

15 FIG. 32, for example), a fax utilization report (see fax utilization report UI 3300 in FIG. 

33, for example), a document utilization report (see document utilization report UI 3400 
in FIG. 34, for example), a web utilization report (see web utilization report UI 3500 in 
FIG. 35, for example), a web access utilization report(see web access utilization report UI 
3600 in FIG. 36, for example), and a remote connection utilization report (see remote 

20 connection utilization report UI 3700 in FIG. 37, for example) and the like. Although 
like reports are illustrated together, the present invention can generate reports with more 
and/or less information and/or mixed types of information. One skilled in the art will 
appreciate that information generated by the present invention can be presented to a user 
and/or client by other means and/or in other formats within the scope of the present 

25 invention. Reports can also be accessed via a remote user portal UI 3800 as shown in 

FIG. 38, for example, and/or via a management console UI 3900 illustrated in FIG. 39, 
for example. 

Still yet another instance of the present invention facilitates statusing of servers 
and/or networks health and/or performance such as reporting performance parameters 
30 and errors and the like. An overall summary for a particular server in a network can be 

provided via an overall server summary performance report UI 4000 such as that shown 
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in FIG. 40. System performance parameters can include, but are not limited to, memory 
in use, free disk space, busy disk time, and CPU utilization and the like as illustrated in a 
performance summary report Ul 41 00 in FIG. 41 . Performance parameters can also be 
grouped into a 'Top X" processes in Y amount of time format by individual performance 
5 parameters as depicted in a Top 5 performance parameter report UI 4200 shown in FIG. 

42. Errors can include, but are not limited to, health monitor alerts (see critical alerts 
report UI 4400 in FIG. 44), auto services that aren't running (see service failure report UI 
4300 in FIG. 43), and event log errors (see critical errors in application log report UI 
4400 in FIG. 44) and the like. One skilled in the art will appreciate that information 

10 generated by the present invention can be presented to a user and/or client by other 

means and/or in other formats within the scope of the present invention. Reports can also 
be accessed via a remote user portal UI 3800 as shown in FIG. 38, for example and/or via 
a management console UI 3900 illustrated in FIG. 39, for example. Although like reports 
are illustrated together, the present invention can generate reports with more and/or less 

1 5 information and/or mixed types of information. 

In order to provide additional context for implementing various aspects of the 
present invention, FIG. 45 and the following discussion is intended to provide a brief, 
general description of a suitable computing environment 4500 in which the various 
aspects of the present invention may be implemented. While the invention has been 

20 described above in the general context of computer-executable instructions of a computer 
program that runs on a local computer and/or remote computer, those skilled in the art 
will recognize that the invention also may be implemented in combination with other 
program modules. Generally, program modules include routines, programs, components, 
data structures, etc., that perform particular tasks and/or implement particular abstract 

25 data types. Moreover, those skilled in the art will appreciate that the inventive methods 

may be practiced with other computer system configurations, including single-processor 
or multi-processor computer systems, minicomputers, mainframe computers, as well as 
personal computers, hand-held computing devices, microprocessor-based and/or 
programmable consumer electronics, and the like, each of which may operatively 

30 communicate with one or more associated devices. The illustrated aspects of the 

invention may also be practiced in distributed computing environments where certain 
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tasks are performed by remote processing devices that are linked through a 
communications network. However, some, if not all, aspects of the invention may be 
practiced on stand-alone computers. In a distributed computing environment, program 
modules may be located in local and/or remote memory storage devices. 
5 As used in this application, the term "component" is intended to refer to a 

computer-related entity, either hardware, a combination of hardware and software, 
software, or software in execution. For example, a component may be, but is not limited 
to, a process running on a processor, a processor, an object, an executable, a thread of 
execution, a program, and a computer. By way of illustration, an application running on 

1 0 a server and/or the server can be a component. In addition, a component may include 

one or more subcomponents. 

With reference to FIG. 45, an exemplary system environment 4500 for 
implementing the various aspects of the invention includes a conventional computer 
4502, including a processing unit 4504, a system memory 4506, and a system bus 4508 

1 5 that couples various system components, including the system memory, to the processing 

unit 4504. The processing unit 4504 may be any commercially available or proprietary 
processor. In addition, the processing unit may be implemented as multi-processor 
formed of more than one processor, such as may be connected in parallel. 

The system bus 4508 may be any of several types of bus structure including a 

20 memory bus or memory controller, a peripheral bus, and a local bus using any of a 

variety of conventional bus architectures such as PCI, VESA, MicroChannel, ISA, and 
EISA, to name a few. The system memory 4506 includes read only memory (ROM) 
4510 and random access memory (RAM) 4512. A basic input/output system (BIOS) 
4514, containing the basic routines that help to transfer information between elements 

25 within the computer 4502, such as during start-up, is stored in ROM 4510. 

The computer 4502 also may include, for example, a hard disk drive 4516, a 
magnetic disk drive 451 8, e.g., to read from or write to a removable disk 4520, and an 
optical disk drive 4522, e.g., for reading from or writing to a CD-ROM disk 4524 or other 
optical media. The hard disk drive 4516, magnetic disk drive 4518, and optical disk drive 

30 4522 are connected to the system bus 4508 by a hard disk drive interface 4526, a 

magnetic disk drive interface 4528, and an optical drive interface 4530, respectively. The 
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drives 4516-4522 and their associated computer-readable media provide nonvolatile 
storage of data, data structures, computer-executable instructions, etc. for the computer 
4502. Although the description of computer-readable media above refers to a hard disk, a 
removable magnetic disk and a CD, it should be appreciated by those skilled in the art 
5 that other types of media which are readable by a computer, such as magnetic cassettes, 

flash memory cards, digital video disks, Bernoulli cartridges, and the like, can also be 
used in the exemplary operating environment 4500, and further that any such media may 
contain computer-executable instructions for performing the methods of the present 
invention. 

10 A number of program modules may be stored in the drives 4516-4522 and RAM 

4512, including an operating system 4532, one or more application programs 4534, other 
program modules 4536, and program data 4538. The operating system 4532 may be any 
suitable operating system or combination of operating systems. By way of example, the 
application programs 4534 and program modules 4536 can include an aggregated system 

1 5 data scheme in accordance with an aspect of the present invention. 

A user can enter commands and information into the computer 4502 through one 
or more user input devices, such as a keyboard 4540 and a pointing device {e.g., a mouse 
4542). Other input devices (not shown) may include a microphone, a joystick, a game 
pad, a satellite dish, wireless remote, a scanner, or the like. These and other input devices 

20 are often connected to the processing unit 4504 through a serial port interface 4544 that is 

coupled to the system bus 4508, but may be connected by other interfaces, such as a 
parallel port, a game port or a universal serial bus (USB). A monitor 4546 or other type 
of display device is also connected to the system bus 4508 via an interface, such as a 
video adapter 4548. In addition to the monitor 4546, the computer 4502 may include 

25 other peripheral output devices (not shown), such as speakers, printers, etc. 

It is to be appreciated that the computer 4502 can operate in a networked 
environment using logical connections to one or more remote computers 4560. The 
remote computer 4560 may be a workstation, a server computer, a router, a peer device or 
other common network node, and typically includes many or all of the elements 

30 described relative to the computer 4502, although, for purposes of brevity, only a 

memory storage device 4562 is illustrated in FIG. 45. The logical connections depicted 
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in FIG. 45 can include a local area network (LAN) 4564 and a wide area network (WAN) 
4566. Such networking environments are commonplace in offices, enterprise- wide 
computer networks, intranets and the Internet. 

When used in a LAN networking environment, for example, the computer 4502 is 
5 connected to the local network 4564 through a network interface or adapter 4568. When 

used in a WAN networking environment, the computer 4502 typically includes a modem 
(e.g., telephone, DSL, cable, etc.) 4570, or is connected to a communications server on 
the LAN, or has other means for establishing communications over the WAN 4566, such 
as the Internet. The modem 4570, which can be internal or external relative to the 

10 computer 4502, is connected to the system bus 4508 via the serial port interface 4544. In 

a networked environment, program modules (including application programs 4534) 
and/or program data 4538 can be stored in the remote memory storage device 4562. It 
will be appreciated that the network connections shown are exemplary, and other means 
(e.g., wired or wireless) of establishing a communications link between the computers 

1 5 4502 and 4560 can be used when carrying out an aspect of the present invention. 

In accordance with the practices of persons skilled in the art of computer 
programming, the present invention has been described with reference to acts and 
symbolic representations of operations that are performed by a computer, such as the 
computer 4502 or remote computer 4560, unless otherwise indicated. Such acts and 

20 operations are sometimes referred to as being computer-executed. It will be appreciated 

that the acts and symbolically represented operations include the manipulation by the 
processing unit 4504 of electrical signals representing data bits which causes a resulting 
transformation or reduction of the electrical signal representation, and the maintenance of 
data bits at memory locations in the memory system (including the system memory 4506, 

25 hard drive 45 1 6, floppy disks 4520, CD-ROM 4524, and remote memory 4562) to 

thereby reconfigure or otherwise alter the computer system's operation, as well as other 
processing of signals. The memory locations where such data bits are maintained are 
physical locations that have particular electrical, magnetic, or optical properties 
corresponding to the data bits. 

30 FIG. 46 is another block diagram of a sample computing environment 4600 with 

which the present invention can interact. The system 4600 further illustrates a system 
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that includes one or more client(s) 4602. The client(s) 4602 can be hardware and/or 
software (e.g., threads, processes, computing devices). The system 4600 also includes 
one or more server(s) 4604. The server(s) 4604 can also be hardware and/or software 
{e.g.. threads, processes, computing devices). The servers 4604 can house threads to 
5 perform transformations by employing the present invention, for example. One possible 

communication between a client 4602 and a server 4604 may be in the form of a data 
packet adapted to be transmitted between two or more computer processes. The system 
4600 includes a communication framework 4608 that can be employed to facilitate 
communications between the client(s) 4602 and the server(s) 4604. The client(s) 4602 

10 are operably connected to one or more client data store(s) 4610 that can be employed to 

store information local to the client(s) 4602. Similarly, the server(s) 4604 are operably 
connected to one or more server data store(s) 4606 that can be employed to store 
information local to the servers 4604. 

In one instance of the present invention, a data packet transmitted between two or 

15 more computer components that facilitates networked system health alert determination, 

the data packet is comprised of, at least in part, information relating to health alert 
monitoring of a networked system, the information including, at least in part, aggregated 
health related data that is time-averaged data of health related parameters corresponding 
to at least one system component of the networked system. 

20 In another instance of the present invention, a data packet transmitted between 

two or more computer components that facilitates networked system state determination, 
the data packet is comprised of, at least in part, information relating to a state of a 
networked system, the state determined via aggregation and analysis of data from at least 
a subset of system components of the networked system. 

25 In yet another instance of the present invention, a data packet transmitted between 

two or more computer components that facilitates networked system monitoring, the data 
packet is comprised of, at least in part, information relating to monitoring of a networked 
system, the information including, at least in part, state related data based, at least in part, 
upon aggregated state data corresponding to at least one system component of the 

30 networked system. 
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It is to be appreciated that the systems and/or methods of the present invention 
can be utilized in aggregating system data for facilitating computer components and non- 
computer related components alike. Further, those skilled in the art will recognize that 
the systems and/or methods of the present invention are employable in a vast array of 
5 electronic related technologies, including, but not limited to, computers, servers and/or 

handheld electronic devices, and the like. 

What has been described above includes examples of the present invention. It is, 
of course, not possible to describe every conceivable combination of components or 
methodologies for purposes of describing the present invention, but one of ordinary skill 

10 in the art may recognize that many further combinations and permutations of the present 

invention are possible. Accordingly, the present invention is intended to embrace all 
such alterations, modifications and variations that fall within the spirit and scope of the 
appended claims. Furthermore, to the extent that the term ''includes" is used in either the 
detailed description or the claims, such term is intended to be inclusive in a manner 

15 similar to the term "comprising" as "comprising" is interpreted when employed as a 

transitional word in a claim. 
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